Using AI in your business without getting burned

Every business owner in the country has now been told, roughly forty times, that AI will transform their operation. Less often does anyone tell them which part, how much, or what it costs when it's wrong. So here's the version we'd give a client over coffee. No hype, no doom, just where the line is.

What it's genuinely good at

AI earns its keep on a specific shape of task: high volume, repetitive, tolerant of a quick human check, and painful to do by hand. In a normal SA business that's a longer list than people expect.

Reading documents. Pulling the vendor, date, amount and VAT off a photographed till slip; getting structured fields out of an invoice or a bank statement. This is drudgery for a person and well within reach for a model, with a check on the ones it's unsure about.
Drafting the first version. A quote, a supplier email, a product description, a reply to a common customer question. AI is a fast, mediocre first-drafter, which is exactly what you want when the alternative is a blank page and twenty minutes.
Triaging and sorting. Routing incoming messages, flagging the unusual transaction, grouping support tickets by topic. Deciding what needs a person is something AI does well, even when being the person is not.

The through-line: AI is strong at the mechanical, high-volume middle of a task, and weakest at the two ends: the messy input and the final call.

Where it will quietly cost you

The danger isn't that AI fails loudly. It's that it fails plausibly. It will give you a wrong VAT figure formatted exactly like a right one. It will confidently invent a policy detail that sounds like something you'd say. It doesn't know when it doesn't know, and it never sounds unsure.

So the rule we build by: never let AI make the final, unreviewed call on anything that's hard to reverse or expensive to get wrong. Posting the ordinary receipt, fine. Deciding a large or unusual one on its own, no. That goes to a person. Drafting the customer reply, yes. Sending it unread on a sensitive account, no. The model does the ninety-nine percent; a human keeps the one percent that carries the risk. That's not AI being disappointing. That's AI being used correctly.

The part nobody puts on the slide: POPIA

If you're feeding customer or supplier data into an AI tool, you are processing personal information, and POPIA applies. Two practical questions decide whether you're exposing yourself:

Where does the data go? A free consumer AI tool may retain what you paste and use it to train future models. Business-grade tools and APIs generally don't, but you have to check, not assume. Your customers' data ending up in someone's training set is exactly the breach POPIA exists to prevent.
Where does it live? Data residency matters for some SA obligations and for a lot of client contracts. Knowing whether your automation runs on infrastructure you control, or on a server whose location you can't name, is not a technicality. It's the first thing a serious partner will ask.

This is answerable and manageable. It is just not optional, and "the AI vendor handles it" is not an answer you can give a regulator.

How to actually start, without a moon-shot budget

The businesses that get burned tend to start with the biggest, most visible process and try to automate all of it at once. The ones that win start small and specific.

Pick one painful, repetitive job, the one that costs a person the most hours for the least judgement. Not your crown jewels; your worst chore.
Automate the mechanical middle, keep a human on the edges. Prove it on real work, with a person checking the flagged cases, until the numbers earn trust.
Measure the before and after in hours and rands, not vibes. If it isn't handing back time you can point to, it isn't working, and you should say so.
Then move the line. Once it's trustworthy, let it run wider and pick the next chore. Compounding beats a big bang.

The short version

AI is a very good, very fast, occasionally confidently-wrong assistant. Treated as an assistant, pointed at the right chores, checked where it counts and run on infrastructure you can vouch for, it hands back real hours in a South African business today. Treated as an oracle you stop supervising, it will eventually hand you a plausible-looking mistake at the worst possible moment.

The whole skill is knowing which is which. That's most of what we do: find the chore, automate the middle, keep the judgement.